Code Review

<!-- Synced from glaude. Do not edit in project repos. -->
# /code-review — Multi-Perspective Code Review

Comprehensive code review from multiple perspectives, adapted to the project's architecture.

## Usage

/code-review # Review staged/unstaged changes /code-review # Review specific file /code-review # Review PR and address feedback /code-review --pr # Review current branch as if it were a PR

## What This Does

Multi-perspective code review covering:
1. **Architecture Review** — Layer separation, patterns, dependency direction
2. **Security Review** — Auth, input validation, secrets, injection
3. **Testing Review** — Coverage, mocks, edge cases
4. **Code Quality Review** — Style, type hints, error handling, clarity
5. **Project-Specific Review** — Patterns from `.claude/rules/`

## Review Areas

### 1. Architecture Review

- [ ] Layer boundaries respected (read `.claude/rules/` for project-specific layers)
- [ ] No business logic in presentation/route handlers
- [ ] Correct dependency direction between layers
- [ ] Dependency injection used appropriately
- [ ] Async/concurrent patterns correct

### 2. Security Review

- [ ] Auth/permission checks on every endpoint/route
- [ ] Input validated at system boundaries
- [ ] No injection vectors (SQL, XSS, command injection)
- [ ] Secrets not hardcoded or logged
- [ ] No sensitive data in responses or logs
- [ ] CSRF protection for web forms

### 3. Testing Review

- [ ] Key paths tested (happy path + error path)
- [ ] Edge cases covered
- [ ] Permission/auth checks tested
- [ ] Mock strategy appropriate (mocks at boundaries, not internals)
- [ ] Tests are deterministic and isolated

### 4. Code Quality Review

- [ ] Language idioms and style conventions followed
- [ ] Type hints/annotations present
- [ ] Error handling appropriate (not too broad, not too narrow)
- [ ] Logging at key decision points (no sensitive data)
- [ ] Code is clear and self-documenting
- [ ] No dead code or commented-out code

### 5. Project-Specific Review

Read `.claude/rules/*.md` and apply all project-specific constraints. **Check `workflow-project.md` for extra review passes** (e.g., Slack patterns, Terraform patterns, iOS/native, Firestore, IAM/security) — run each as an additional review area with the same severity ratings. Common areas:
- Architecture patterns specific to the project
- Database/ORM conventions
- API design conventions
- Git workflow conventions

## Review Process

### For Staged/Unstaged Changes

1. Get the diff: `git diff` and `git diff --staged`
2. Apply all review checklists above
3. Read `.claude/rules/` for project-specific constraints
4. Report findings with severity and line references
5. Fix issues found

### For Specific File

1. Read the file
2. Apply all review checklists
3. Report findings with line numbers

### For PR

1. Fetch PR details: `gh pr view <number>`
2. Fetch PR comments: `gh api repos/<owner>/<repo>/pulls/<number>/comments`
3. Review code: `gh pr diff <number>`
4. Apply all review checklists
5. Fix issues, commit, push
6. Post summary comment on PR
7. Resolve all review threads

## Output Format

CODE REVIEW:

[1/5] Architecture Review Status: pass | concern | issue Details:

[2/5] Security Review Status: pass | concern | issue Details:

[3/5] Testing Review Status: pass | concern | issue Details:

[4/5] Code Quality Review Status: pass | concern | issue Details:

[5/5] Project-Specific Review Status: pass | concern | issue Details:

---

SUMMARY Critical: X (must fix) Important: Y (should fix) Suggestions: Z (optional)

Next steps:

1. Fix critical and important issues
2. Run validation
3. Commit changes

## When to Use

- Before committing (review staged changes)
- Before creating PR (final check)
- After receiving PR feedback (address comments)
- When unsure about approach (get feedback)
- As part of `/chunk` workflow (step 7)

## Integration

- `/chunk` — runs code review before committing each bead
- `/closeout` — runs code review before creating PR
- `/ralph-run` — workers run code review in quality gate
- CodeRabbit — complements manual review with AI review